Knowledge + Practice

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 676–750

1711 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 10 of 23

676

MCQhard

Refer to the exhibit. A data engineer has attached this bucket policy to an S3 bucket named data-lake-bucket. The engineer wants to allow only GET requests from the corporate network (10.0.0.0/16) over HTTPS. However, users report that they cannot access objects even when connected to the corporate network. What is the issue?

A.The Deny statement should include a condition on the source IP.

B.The Allow statement should include a condition for SecureTransport.

C.The Allow statement should specify s3:GetObject instead of s3:GetObject.

D.The Deny statement blocks all requests that are not using HTTPS, including those from the corporate network.

AnswerD

Deny overrides Allow when condition is met.

Why this answer

The Deny statement with `aws:SecureTransport` set to `false` blocks all HTTP requests. Since the Allow statement only permits GET requests from the corporate network (10.0.0.0/16) but does not require HTTPS, any request from that network that uses HTTP is denied by the explicit Deny. The Deny statement overrides the Allow, so even legitimate corporate users are blocked if they use HTTP.

Exam trap

AWS often tests the principle that an explicit Deny overrides any Allow, leading candidates to focus on fixing the Allow statement rather than recognizing that the Deny unconditionally blocks HTTP traffic from all sources, including the corporate network.

How to eliminate wrong answers

Option A is wrong because the Deny statement already includes a condition on `aws:SecureTransport`, not on source IP; adding a source IP condition would not fix the HTTPS enforcement issue. Option B is wrong because the Allow statement already includes a condition for `aws:SecureTransport` equal to `true` in the Deny, but the Allow itself lacks a SecureTransport condition, so it permits both HTTP and HTTPS; adding SecureTransport to the Allow would not resolve the Deny blocking HTTP. Option C is wrong because `s3:GetObject` is the correct action for GET requests; the typo 's3:GetObject' in the question is a red herring, and the actual policy uses the correct action.

Full explanation →

677

MCQhard

A data engineering team is responsible for an Amazon RDS for PostgreSQL instance that stores financial data. The database is 500 GB in size. The team needs to create a read replica in a different AWS Region for disaster recovery. The source database has automated backups enabled with a retention period of 7 days. The team initiates the cross-region read replica creation. After several hours, the replica status shows 'Replication Lag' of 30 minutes and is increasing. What should the team do to reduce the replication lag?

A.Modify the source DB instance to use a larger instance class.

B.Delete the replica and create a new one from a snapshot.

C.Increase the backup retention period to 35 days.

D.Enable Multi-AZ on the source database instance.

AnswerA

A larger instance class can increase source performance, allowing faster WAL generation and shipping, which may reduce replication lag if the source is bottlenecked.

Why this answer

Modifying the source DB instance to a larger instance class provides more compute and memory resources. If the source instance is resource-constrained, this can reduce I/O contention and allow it to generate and ship write-ahead logs (WAL) more efficiently, potentially decreasing the replication lag to the cross-region read replica. Enabling Multi-AZ on the source database adds a synchronous standby in a different Availability Zone, which does not offload cross-region replication tasks and can increase write latency and resource overhead on the primary, possibly exacerbating replication lag.

Deleting and recreating the replica from a snapshot or increasing backup retention does not address ongoing replication performance.

Exam trap

Candidates might think enabling Multi-AZ on the source database could reduce cross-region replication lag because it introduces a standby that might appear to offload work. In reality, Multi-AZ replicates synchronously to the standby for high availability, but cross-region read replicas replicate asynchronously directly from the primary. Multi-AZ can actually increase I/O load on the primary, potentially worsening replication lag.

A larger source instance can help if the primary is under-provisioned.

How to eliminate wrong answers

Option A is wrong because increasing the instance class of the source DB may improve its processing capacity, but replication lag for a cross-region read replica is primarily caused by network latency and the time it takes to ship WAL data across regions, not by the source instance's compute power. Option B is wrong because deleting the replica and creating a new one from a snapshot does not address the underlying cause of lag; the new replica will still experience the same cross-region replication delay. Option C is wrong because increasing the backup retention period to 35 days only affects how long automated backups are kept, not the replication performance or lag of a read replica.

Full explanation →

678

MCQmedium

A company is using Amazon RDS for MySQL and needs to automate backups with a retention period of 35 days. They also want to be able to restore to any point within the retention period. Which configuration should be used?

A.Enable manual snapshots daily and retain for 35 days.

B.Set the backup retention period to 35 days and enable automatic backups.

C.Set the backup retention period to 7 days and create daily manual snapshots.

D.Disable automated backups and rely on Multi-AZ for recovery.

AnswerB

Automated backups allow point-in-time recovery within the retention period.

Why this answer

Amazon RDS for MySQL supports automated backups with a configurable retention period of up to 35 days. By setting the backup retention period to 35 days and enabling automatic backups, RDS automatically performs daily snapshots and transaction log backups, enabling point-in-time recovery (PITR) to any second within the retention window. This meets the requirement for both a 35-day retention and full PITR capability without manual intervention.

Exam trap

The trap here is that candidates often confuse manual snapshots (which are retained indefinitely but do not support PITR) with automated backups (which support PITR but have a maximum retention of 35 days), leading them to choose Option A or C, thinking manual snapshots can extend the PITR window.

How to eliminate wrong answers

Option A is wrong because manual snapshots are not automatically taken daily and do not support point-in-time recovery; they only provide a single point-in-time restore, not continuous PITR. Option C is wrong because setting the backup retention period to 7 days limits automated backups and PITR to only 7 days, and adding daily manual snapshots does not extend the PITR window beyond 7 days. Option D is wrong because disabling automated backups eliminates both automated snapshots and transaction log backups, making PITR impossible; Multi-AZ provides high availability but does not create backups or enable recovery to any point in time.

Full explanation →

679

MCQmedium

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

A.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}

B.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}

C.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}

D.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}

AnswerB

Grants access only to objects under sensitive/ prefix.

Why this answer

It grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix.

Option D is wrong because it grants access to all objects in the bucket.

Full explanation →

680

MCQeasy

A startup is building a real-time analytics application using Amazon Kinesis Data Streams and Amazon Kinesis Data Analytics. The application processes clickstream data from a website. The data is also stored in Amazon S3 for historical analysis. The company uses an S3 bucket with a lifecycle policy that transitions objects to Amazon S3 Glacier Deep Archive after 30 days. The data engineering team has configured a Kinesis Data Firehose delivery stream to write data to the S3 bucket. The team notices that the data in S3 is not being transitioned to Glacier Deep Archive after 30 days. The lifecycle policy is correctly configured and has been verified. What is the most likely cause of this issue?

A.The S3 lifecycle rule is configured with a filter that does not match the prefix used by Kinesis Data Firehose.

B.The Glacier Deep Archive storage class requires a minimum 90-day storage period, so the lifecycle policy cannot transition objects after 30 days.

C.The S3 bucket is not enabled for S3 Intelligent-Tiering, which is required for lifecycle transitions to Glacier Deep Archive.

D.The S3 bucket does not have S3 Batch Operations enabled to invoke the lifecycle policy.

AnswerA

Correct. If the lifecycle rule's filter (e.g., prefix, tags) does not match the prefix that Kinesis Data Firehose uses when writing objects, the rule will not be applied to those objects. Firehose typically writes objects with a date-based prefix, so ensure the rule filter matches that prefix.

Why this answer

The most likely cause is that the S3 lifecycle rule has a filter that does not match the prefix used by Kinesis Data Firehose. Firehose writes objects with a specific prefix pattern (e.g., 'year/month/day/hour/...'), and if the lifecycle rule is configured with a different prefix filter, the rule will not apply to those objects. Option A is correct.

Option B is incorrect because the minimum 90-day storage period for Glacier Deep Archive is a billing consideration, not a restriction on lifecycle transitions; objects can be transitioned after 30 days, but early deletion fees may apply. Option C is incorrect because S3 Intelligent-Tiering is not required for lifecycle transitions to Glacier Deep Archive; any S3 bucket can have lifecycle rules. Option D is incorrect because S3 Batch Operations are not involved in lifecycle transitions; they are used for bulk operations like copying or restoring objects.

Full explanation →

681

MCQeasy

A data engineer needs to monitor the number of records processed by an AWS Glue ETL job. Which CloudWatch metric should the engineer use?

A.glue.driver.aggregate.elapsedTime

B.glue.driver.aggregate.numRecords

C.glue.driver.aggregate.bytesRead

D.glue.driver.aggregate.recordsRead

AnswerB

This metric tracks the number of records processed.

Why this answer

Glue emits a 'glue.driver.aggregate.numRecords' metric for the number of records processed. Option A is wrong because 'glue.driver.aggregate.elapsedTime' is for time. Option C is wrong because 'glue.driver.aggregate.bytesRead' is for bytes.

Option D is wrong because 'glue.driver.aggregate.recordsRead' is not a standard metric.

Full explanation →

682

Multi-Selecthard

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Select 2 answers

A.The VPC security group does not allow outbound HTTPS traffic

B.The S3 bucket policy denies access to the IAM role

C.The S3 bucket has default encryption enabled

D.The IAM role does not have the s3:GetObject permission

E.The KMS key used for encryption is not shared with Redshift

AnswersB, D

The bucket policy can override the IAM role permissions.

Why this answer

Options B and D are correct. The IAM role must have permission to the S3 bucket, and the bucket policy must allow the role. Option A is wrong because VPC security groups control network traffic, not S3 access.

Option C is wrong because encryption is not required for COPY. Option E is wrong because Redshift does not need KMS permissions unless using SSE-KMS.

Full explanation →

683

Matchingmedium

Match each AWS security service to its purpose in data protection.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Managed encryption keys

User and role access control

Audit API activity

Discover and protect sensitive data

Web application firewall

Why these pairings

The correct matches are: AWS KMS for encryption key management, AWS IAM for access control, and AWS CloudTrail for API auditing. Common confusions include swapping these services' purposes.

Full explanation →

684

Multi-Selectmedium

A company is designing a data store for IoT sensor data that is written once and never updated. The data must be stored with high durability and low cost. Which TWO AWS storage services are most suitable? (Choose TWO.)

Select 2 answers

A.Amazon ElastiCache

B.Amazon EBS

C.Amazon S3

D.Amazon DynamoDB

E.Amazon S3 Glacier Deep Archive

AnswersC, E

S3 provides 99.999999999% durability and low cost for infrequently accessed data.

Why this answer

Amazon S3 is correct because it provides 99.999999999% (11 9's) durability, is designed for write-once-read-many (WORM) workloads, and offers low-cost storage tiers suitable for IoT sensor data that is never updated. S3's object storage model and lifecycle policies allow automatic transition to colder storage, making it ideal for immutable data at scale.

Exam trap

The trap here is that candidates often choose DynamoDB (D) for its scalability and low latency, overlooking that the question emphasizes low cost and write-once immutability, where S3 and Glacier Deep Archive are orders of magnitude cheaper per GB stored.

Full explanation →

685

Multi-Selectmedium

A company runs a data lake on Amazon S3 with AWS Glue for ETL. The data is stored in Parquet format and partitioned by date. The data engineer notices that queries using Amazon Athena are scanning large amounts of data even when filtering on the partition column. Which TWO actions would improve query performance? (Choose TWO)

Select 2 answers

A.Use a different file format like Avro

B.Ensure that the WHERE clause uses the partition column correctly

C.Convert the data from Parquet to CSV for better compression

D.Increase the number of partitions by adding a second partition column

E.Enable predicate pushdown in Athena

AnswersB, E

Enables partition pruning.

Why this answer

Partition pruning requires the WHERE clause to filter on the partition column to reduce data scanned. Option E is correct because enabling predicate pushdown in Athena allows the query engine to push filtering conditions down to the data source, further reducing the amount of data scanned. Option A is incorrect because while Avro is a row-oriented format, it is not more efficient for analytics than Parquet; Parquet is columnar and better for selective queries.

Option C is incorrect because CSV is not compressed and would increase data scanned. Option D is incorrect because simply increasing the number of partitions without proper filtering does not improve performance; excessive partitions can even degrade performance due to metadata overhead.

Full explanation →

686

MCQhard

A company uses Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The data is in JSON format and contains a 'timestamp' field with a Unix epoch value. The company wants to partition the S3 objects by year, month, day, and hour based on the timestamp. What is the MOST efficient method to achieve this?

A.Use the dynamic partitioning feature of Kinesis Data Firehose with inline parsing to extract the timestamp and create the S3 prefix.

B.Configure a custom S3 prefix in Firehose using the 'YYYY/MM/dd/HH' format based on the current time.

C.Use an AWS Glue ETL job to read from Firehose, partition, and write to S3.

D.Use Amazon Athena to run a CTAS query that partitions the data by timestamp.

AnswerA

Correct. Kinesis Data Firehose dynamic partitioning allows inline parsing to extract the timestamp from JSON data and automatically creates S3 prefixes based on the specified keys (year, month, day, hour).

Why this answer

Kinesis Data Firehose supports dynamic partitioning with inline parsing to extract the timestamp and create the S3 prefix by year, month, day, and hour. Option B is incorrect because a custom prefix based on current time would use the delivery time, not the event timestamp, so partitioning would not reflect the actual data timestamps. Option C is incorrect because using an AWS Glue ETL job introduces additional latency and complexity; Firehose can partition directly without needing an extra service.

Option D is incorrect because Amazon Athena is a query engine, not an ingestion tool; running a CTAS query would require the data to already be in S3 and adds overhead.

Full explanation →

687

MCQeasy

A company wants to ingest real-time data from a social media API into Amazon S3 for analysis. The API provides data as JSON records. Which AWS service is best suited for this ingestion?

A.AWS Glue

B.Amazon Kinesis Data Firehose

C.Amazon Simple Queue Service (SQS)

D.Amazon DataZone

AnswerB

Firehose is designed for streaming data ingestion into S3.

Why this answer

Amazon Kinesis Data Firehose is the best choice because it is a fully managed service designed to ingest real-time streaming data, such as JSON records from a social media API, and automatically load it into Amazon S3 with optional data transformation and compression. It handles scaling, buffering, and delivery without requiring custom code or infrastructure management, making it ideal for this use case.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams (which requires custom consumers) with Kinesis Data Firehose (which is serverless and directly writes to S3), or they incorrectly assume SQS can directly deliver to S3 without additional processing.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless data integration service for batch ETL (extract, transform, load) jobs and cataloging, not designed for real-time streaming ingestion from an API. Option C is wrong because Amazon Simple Queue Service (SQS) is a message queue for decoupling application components, but it does not natively write data to S3; you would need additional compute to poll and deliver messages, adding complexity. Option D is wrong because Amazon DataZone is a data governance and catalog service for managing data assets across an organization, not a data ingestion service for real-time streaming.

Full explanation →

688

Multi-Selectmedium

Which TWO actions should a data engineer take to encrypt data at rest in an Amazon S3 bucket? (Select TWO.)

Select 2 answers

A.Enable S3 Transfer Acceleration on the bucket.

B.Use client-side encryption before uploading objects to S3.

C.Configure the bucket to use SSE-KMS.

D.Enable default encryption on the bucket using SSE-S3.

E.Attach a bucket policy that denies unencrypted PUT requests.

AnswersC, D

SSE-KMS encrypts objects at rest using AWS KMS keys.

Why this answer

SSE-KMS (Server-Side Encryption with AWS Key Management Service) encrypts data at rest in S3 by using a KMS key to manage encryption keys. This provides envelope encryption, where a CMK generates a data key that encrypts the object, and the data key is then encrypted by the CMK. Option D is correct because enabling default encryption on an S3 bucket using SSE-S3 (AES-256) ensures that all objects uploaded without explicit encryption headers are automatically encrypted at rest by S3's managed key.

Exam trap

The trap here is that candidates confuse enforcing encryption (via bucket policies) with actually performing encryption, or they mistakenly think client-side encryption is a bucket-level action rather than a client-side responsibility.

Full explanation →

689

Multi-Selecthard

A company uses Amazon Redshift for its data warehouse. The cluster has multiple node types and is configured with automated snapshots. The company needs to ensure high availability and disaster recovery across AWS Regions. Which THREE actions should the company take to meet these requirements? (Choose THREE.)

Select 3 answers

A.Enable automated snapshots with a retention period of at least 1 day.

B.Restore a snapshot from the secondary Region in the event of a disaster.

C.Create manual snapshots on a daily basis and copy them to another Region.

D.Configure the cluster to use multiple Availability Zones (multi-AZ) for high availability.

E.Configure cross-Region snapshot copy to replicate snapshots to another Region.

AnswersB, D, E

Restoring from a cross-Region snapshot provides DR capability.

Why this answer

Restoring a snapshot from a secondary Region is the core disaster recovery action in a cross-Region DR strategy. When a primary Region fails, you can restore the cross-Region snapshot copy to a new Redshift cluster in the secondary Region, ensuring business continuity. This leverages the automated cross-Region copy configured in Option E to make the snapshot available in the DR Region.

Exam trap

The trap here is that candidates often confuse high availability (multi-AZ) with disaster recovery (cross-Region snapshot copy), or assume that local automated snapshots alone satisfy cross-Region DR requirements without explicitly enabling cross-Region copy.

Full explanation →

690

MCQmedium

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

A.The S3 bucket policy allows full access to all principals

B.The users are using a version of Athena that does not support Lake Formation

C.The S3 bucket does not have server-side encryption enabled

D.Lake Formation does not support integration with Athena

AnswerB

Correct. Athena engine version 1 does not support Lake Formation integration, so users can bypass Lake Formation permissions and query data directly.

Why this answer

Athena workgroups using engine version 1 do not support integration with Lake Formation. In such cases, Lake Formation permissions are not enforced, and users can query the underlying S3 data directly through Athena, bypassing Lake Formation's access controls. Option A is incorrect: while a permissive S3 bucket policy could allow direct access, the most likely cause given Lake Formation integration is the Athena version.

Option C is incorrect because server-side encryption does not affect Lake Formation's ability to enforce permissions. Option D is incorrect: Lake Formation does integrate with Athena, but only when using Athena engine version 2 or later.

Full explanation →

691

MCQmedium

A data engineer is designing a data lake on Amazon S3. The data includes sensitive customer information that must be encrypted at rest. Which combination of actions meets this requirement with minimal operational overhead?

A.Enable default encryption on the S3 bucket using SSE-S3

B.Encrypt objects client-side before uploading

C.Use an S3 bucket policy to deny writes without encryption

D.Use an S3 Lifecycle policy to transition to Glacier

AnswerA

SSE-S3 encrypts objects at rest using server-side encryption with Amazon-managed key material, requiring no customer key management or KMS API calls. This satisfies the encryption-at-rest requirement while minimising operational overhead, as the engineer does not need to manage keys, rotate them, or configure custom key policies, unlike SSE-KMS or client-side encryption.

Why this answer

SSE-S3 provides server-side encryption with Amazon S3-managed keys, which encrypts data at rest with minimal operational overhead because AWS handles key management, rotation, and encryption/decryption transparently. Enabling default encryption on the S3 bucket ensures that all objects written to the bucket are automatically encrypted without requiring any client-side changes or additional code, meeting the requirement with the least administrative effort.

Exam trap

The trap here is that candidates often confuse 'enforcing encryption via bucket policy' (Option C) with 'automatically encrypting data' — the policy only denies unencrypted writes but does not reduce operational overhead because the client must still implement encryption logic.

How to eliminate wrong answers

Option B is wrong because client-side encryption requires the data engineer to manage encryption keys and perform encryption/decryption in the application code, adding significant operational overhead compared to server-side encryption. Option C is wrong because an S3 bucket policy that denies writes without encryption only enforces encryption at upload time but does not itself encrypt the data; it relies on the client to provide encryption headers, which still requires client-side logic and does not reduce overhead. Option D is wrong because an S3 Lifecycle policy to transition to Glacier only moves data to a different storage class for cost optimization, it does not provide encryption at rest; Glacier itself supports encryption but the lifecycle policy does not enable or enforce it.

Full explanation →

692

MCQeasy

A company needs to migrate an on-premises 10 TB PostgreSQL database to Amazon RDS for PostgreSQL with minimal downtime. Which AWS service should be used for the migration?

A.AWS Storage Gateway

B.AWS Snowball Edge

C.AWS DataSync

D.AWS Database Migration Service (DMS)

AnswerD

DMS supports continuous replication.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. It supports continuous replication from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL using change data capture (CDC), allowing the source database to remain operational during the migration.

Exam trap

The trap here is that candidates may confuse data transfer services (like Snowball Edge or DataSync) with database migration tools, overlooking that DMS is the only AWS service that supports live, ongoing replication and schema conversion for relational databases like PostgreSQL.

How to eliminate wrong answers

Option A is wrong because AWS Storage Gateway is a hybrid storage service for on-premises access to cloud storage, not a database migration tool; it cannot perform schema conversion or ongoing replication for a PostgreSQL database. Option B is wrong because AWS Snowball Edge is a physical data transport device for large-scale data transfers, but it does not support live database replication or CDC, making it unsuitable for minimal-downtime migrations of a live 10 TB database. Option C is wrong because AWS DataSync is designed for moving large amounts of file data over the network, not for database-level migrations; it lacks the ability to handle PostgreSQL-specific objects, transactions, or ongoing replication.

Full explanation →

693

Multi-Selecthard

A company runs a data processing pipeline using Amazon EMR with Spark. The pipeline reads from S3, processes data, and writes to S3. Recently, the job started failing with 'S3AccessDeniedException' even though the EMR role has appropriate S3 permissions. Which TWO actions should the data engineer take to resolve this issue? (Choose TWO.)

Select 2 answers

A.Enable S3 versioning on the bucket to allow multiple access methods.

B.Verify that the EMR service role has the necessary S3 permissions in IAM.

C.Disable S3 Block Public Access settings on the bucket.

D.Check the S3 bucket policy for explicit deny statements that may override the IAM role.

E.Ensure the EMR cluster is launched in a VPC with an S3 VPC endpoint.

AnswersB, D

The EMR service role (EMR_EC2_DefaultRole) must have permissions.

Why this answer

Options B and D are correct. B: The EMR service role (and instance profile) must have an IAM policy granting S3 permissions; verifying these ensures the role has the necessary access. D: S3 bucket policies can include explicit deny statements that override IAM permissions, even if the IAM role allows access; checking the bucket policy can reveal such denies.

Option A is wrong because S3 versioning does not affect access permissions. Option C is wrong because disabling S3 Block Public Access is unrelated to IAM-based access from EMR. Option E is wrong because an S3 VPC endpoint is not required if the cluster can access S3 via the internet or a NAT gateway.

Full explanation →

694

MCQmedium

A data engineer is troubleshooting an Amazon RDS for MySQL instance that is experiencing high read latency. The instance is a Single-AZ db.r5.large with 100 GB of General Purpose (gp2) storage. Which action is most likely to reduce read latency?

A.Create a read replica and direct read queries to it.

B.Enable automatic backups with a 7-day retention.

C.Increase the allocated storage to 200 GB.

D.Convert the instance to a Multi-AZ deployment.

AnswerA

Offloads read traffic, reducing load on the primary.

Why this answer

Creating a read replica offloads SELECT queries from the primary instance, directly reducing the read load and thus read latency. Since the instance is Single-AZ and experiencing high read latency, a read replica distributes the read traffic without altering the existing storage or availability configuration.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming Multi-AZ provides read scaling, but Multi-AZ only provides a standby for failover, not a read endpoint.

How to eliminate wrong answers

Option B is wrong because enabling automatic backups with a 7-day retention does not reduce read latency; backups consume I/O and CPU resources, potentially increasing latency. Option C is wrong because increasing allocated storage to 200 GB on gp2 improves baseline IOPS (from 300 to 600) but does not directly address high read latency caused by read workload saturation; the issue is read demand, not storage throughput. Option D is wrong because converting to Multi-AZ provides high availability and failover support but does not reduce read latency; the standby replica is not used for read traffic unless you explicitly configure a read replica.

Full explanation →

695

MCQhard

A social media company ingests user activity data from multiple sources into Amazon S3. The data is in JSON format and includes fields: user_id, activity_type, timestamp, and metadata. The company wants to transform this data into a columnar format (Parquet) partitioned by date and activity_type for efficient querying with Amazon Athena. The pipeline must handle data that arrives up to 3 days late. Currently, a daily AWS Glue ETL job scans the entire S3 bucket for new files, transforms them, and writes to a separate output bucket. The job is taking longer as data volume grows, and the team wants to reduce processing time and cost. What should the engineer do?

A.Increase the number of DPUs for the Glue job to process data faster.

B.Use AWS Glue partition projection and schema inference to reduce scan time.

C.Replace AWS Glue with Amazon EMR and use Spark to process data in parallel.

D.Set up S3 event notifications to invoke an AWS Lambda function that triggers a Glue job for each new object, passing the object key so the job processes only that file.

AnswerD

This enables incremental processing, reduces scan time, and is cost-effective.

Why this answer

Using S3 event notifications with Lambda to trigger a Glue job for each new file allows incremental processing, reducing the time and cost of scanning the entire S3 bucket. Option A (increasing DPUs) does not address the root cause of scanning all files. Option B (partition projection) helps with query performance but not with the transformation process.

Option C (replacing Glue with EMR) adds operational overhead and is not necessary for this use case.

Full explanation →

696

MCQeasy

A company needs to ingest data from an on-premises SQL Server database into Amazon Redshift. The data volume is less than 1 TB and the network bandwidth is limited. Which AWS service should be used for the initial full load?

A.AWS Snowball Edge

B.AWS Database Migration Service (DMS)

C.Amazon S3 Transfer Acceleration

D.AWS Direct Connect

AnswerB

Designed for database migration with limited bandwidth.

Why this answer

AWS DMS is designed for migrating databases to AWS, including to Redshift. Option A (AWS Snowball) is for large data volumes (petabytes) and not efficient for <1 TB. Option C (Amazon S3 Transfer Acceleration) speeds up uploads to S3 but not directly to Redshift.

Option D (AWS Direct Connect) is a network connection, not a migration service.

Full explanation →

697

MCQeasy

A company is using Amazon S3 to store log files. The security team requires that all data be encrypted in transit. Which of the following ensures encryption in transit for S3?

A.Use HTTPS (SSL/TLS) when accessing S3 endpoints.

B.Use Amazon S3 Transfer Acceleration.

C.Enable client-side encryption before uploading to S3.

D.Use server-side encryption with S3 managed keys (SSE-S3).

AnswerA

HTTPS encrypts data in transit between client and S3.

Why this answer

Encryption in transit for S3 is achieved by using HTTPS (SSL/TLS) when accessing S3 endpoints (option A). Option B (Transfer Acceleration) speeds up uploads but does not provide encryption in transit by itself. Option C (client-side encryption) protects data at rest and during transit only if combined with HTTPS.

Option D (SSE-S3) is at-rest encryption. Therefore, the correct answer is A.

Full explanation →

698

MCQeasy

A company stores its application logs in Amazon S3. The logs are generated daily and need to be retained for 3 years for compliance. The logs are accessed frequently for the first 30 days, occasionally for the next 6 months, and rarely after that. The data engineering team wants to minimize storage costs while ensuring that logs are available for retrieval within 12 hours for the first 6 months and within 48 hours after that. The team also wants to automatically delete logs after 3 years. Which lifecycle policy should the team implement?

A.Transition to S3 One Zone-IA after 30 days, delete after 6 months.

B.Transition to S3 Standard-IA after 30 days, delete after 3 years.

C.Transition to S3 Standard-IA after 30 days, to S3 Glacier after 6 months, delete after 3 years.

D.Transition to S3 Standard-IA after 30 days, to S3 Glacier Deep Archive after 6 months, delete after 3 years.

AnswerD

Meets cost and retrieval time requirements.

Why this answer

It aligns with the access patterns and retrieval requirements: S3 Standard-IA after 30 days for occasional access with immediate retrieval, then S3 Glacier Deep Archive after 6 months for rare access with a 12-hour retrieval time (via expedited or standard retrieval), and deletion after 3 years. This minimizes storage costs while meeting the 48-hour retrieval window for older logs.

Exam trap

The trap here is that candidates may choose Option C (S3 Glacier) thinking it is the cheapest cold storage, but S3 Glacier Deep Archive is actually the lowest-cost option for data that is rarely accessed and can tolerate a 12-hour retrieval time, which still satisfies the 48-hour requirement.

How to eliminate wrong answers

Option A is wrong because it transitions to S3 One Zone-IA after 30 days, which does not provide the durability or availability needed for compliance logs, and it deletes after 6 months instead of 3 years. Option B is wrong because it keeps logs in S3 Standard-IA for the entire 3 years, which is more expensive than transitioning to a colder storage class after 6 months, and it does not meet the cost-minimization goal. Option C is wrong because it transitions to S3 Glacier after 6 months, which has a retrieval time of 1-5 minutes for expedited or 3-5 hours for standard, exceeding the 48-hour requirement but not being the most cost-effective option; S3 Glacier Deep Archive is cheaper and still meets the 48-hour retrieval window.

Full explanation →

699

MCQhard

A data engineer is tasked with implementing data masking for a non-production environment. The source data contains credit card numbers stored in an Amazon RDS for PostgreSQL database. The engineer wants to automatically mask the credit card numbers when copying data to the non-production database. Which AWS service can be used to achieve this?

A.AWS Database Migration Service (DMS)

B.AWS Glue

C.AWS Lake Formation

D.Amazon Athena

AnswerA

DMS supports transformation rules that can mask columns during migration.

Why this answer

AWS DMS can transform data during migration using transformation rules. It can mask data by replacing columns with predefined values. Glue is for ETL, but DMS is purpose-built for database migrations with transformations.

Lake Formation is for data lake permissions. Athena is for querying S3 data.

Full explanation →

700

MCQeasy

A data engineer is troubleshooting a failed AWS Glue ETL job. The job reads from an S3 bucket and writes to an RDS MySQL database. The job fails with an 'Access Denied' error when trying to write to RDS. What is the most likely cause?

A.The IAM role associated with the Glue job does not have the necessary permissions to write to the RDS instance.

B.The Glue job is running in a VPC without a route to the internet.

C.The S3 bucket policy does not allow the Glue job to read the data.

D.The RDS instance is encrypted with a KMS key that the Glue job cannot access.

AnswerA

IAM role needs RDS write permissions.

Why this answer

The error 'Access Denied' when writing to RDS indicates that the AWS Glue job's IAM role lacks the necessary permissions (e.g., rds-db:connect, or specific database-level GRANTs) to perform write operations on the RDS MySQL instance. AWS Glue uses the attached IAM role to authenticate and authorize actions against AWS services, and without proper IAM policies allowing access to the RDS resource, the write attempt is denied.

Exam trap

The trap here is that candidates often confuse network connectivity issues (Option B) with authorization errors, but 'Access Denied' is a specific HTTP 403 error indicating lack of permissions, not a network problem.

How to eliminate wrong answers

Option B is wrong because a missing route to the internet would cause a network connectivity timeout or 'connection refused' error, not an 'Access Denied' error, which is an authorization failure. Option C is wrong because the error occurs when writing to RDS, not when reading from S3; an S3 bucket policy issue would produce an S3-specific 'Access Denied' error during the read phase. Option D is wrong because if the RDS instance is encrypted with a KMS key that the Glue job cannot access, the error would typically be a 'KMS access denied' or 'encryption key unavailable' error, not a generic 'Access Denied' for writing to RDS.

Full explanation →

701

MCQhard

A data engineer is designing a data lake on Amazon S3. The compliance team requires that objects be automatically deleted after 7 years. Additionally, objects must be transitioned to Amazon S3 Glacier Instant Retrieval after 30 days to reduce costs. Which S3 lifecycle policy configuration meets these requirements?

A.Transition to Glacier Instant Retrieval after 30 days, then expire after 90 days.

B.Transition to Glacier Instant Retrieval after 30 days, then expire after 2555 days.

C.Transition to Glacier Deep Archive after 30 days, then expire after 7 years.

D.Transition to S3 Standard-IA after 30 days, then expire after 7 years.

AnswerB

2555 days is approximately 7 years.

Why this answer

It transitions objects to S3 Glacier Instant Retrieval after 30 days and then expires (permanently deletes) them after 2555 days, which is approximately 7 years (365 * 7 = 2555). This meets both the cost-saving and deletion requirements. Option A is incorrect because it expires after 90 days, not 7 years.

Option C is incorrect because it uses Glacier Deep Archive instead of Glacier Instant Retrieval. Option D is incorrect because it uses S3 Standard-IA instead of Glacier Instant Retrieval.

Full explanation →

702

MCQeasy

A company wants to import data from an external FTP server into Amazon S3 on a daily basis. The data volumes are moderate. Which AWS service is MOST suitable for this task?

A.Amazon S3 Transfer Acceleration

B.AWS Transfer Family

C.AWS DataSync

D.AWS Glue with a JDBC connection

AnswerB

Transfer Family supports FTP/SFTP/FTPS and directly writes to S3.

Why this answer

AWS Transfer Family is the most suitable service because it provides fully managed support for SFTP, FTPS, and FTP protocols, enabling direct, secure file transfers from an external FTP server to Amazon S3 without needing to manage any infrastructure. It integrates natively with S3, so files are automatically stored in the specified bucket upon transfer completion, making it ideal for daily imports of moderate data volumes.

Exam trap

The trap here is that candidates often confuse AWS DataSync with a general-purpose file transfer tool, but DataSync requires an agent on the source and does not natively support FTP protocols, whereas AWS Transfer Family is purpose-built for FTP-based transfers to S3.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads to S3 over the internet by using AWS edge locations, but it does not support FTP protocols or act as a server-side endpoint to receive files from an external FTP server. Option C is wrong because AWS DataSync is designed for moving large volumes of data between on-premises storage and AWS services, but it requires installing an agent on the source environment and does not natively support FTP as a source protocol. Option D is wrong because AWS Glue with a JDBC connection is intended for extracting data from databases using JDBC drivers, not for handling file transfers over FTP/SFTP/FTPS protocols.

Full explanation →

703

MCQmedium

A data engineer is building a real-time data pipeline to ingest sensor data from IoT devices. The data is sent to AWS IoT Core, which publishes messages to a Kinesis Data Stream. Each message is about 1 KB in size. The data must be transformed (add a device location field) and then stored in Amazon S3 for long-term analytics. The engineer has set up a Lambda function to transform the records and write to S3. However, the engineer notices that the Lambda function is invoked thousands of times per second, causing high costs and occasional throttling. The Lambda function processes only one record at a time. The engineer wants to reduce the number of Lambda invocations and improve throughput. What should the engineer do?

A.Reduce the number of shards in the Kinesis stream to limit concurrency.

B.Increase the Lambda function's memory allocation to improve performance.

C.Replace the Lambda function with Amazon Kinesis Data Firehose and use its built-in transformation.

D.Configure the event source mapping to use a larger batch size and set a batch window.

AnswerD

Correct. Configuring the event source mapping to use a larger batch size and set a batch window allows Lambda to process multiple records in a single invocation, drastically reducing invocation count and improving throughput.

Why this answer

Configuring the event source mapping with a larger batch size and a batch window allows Lambda to process multiple records per invocation, reducing the number of invocations and costs. This improves throughput and reduces throttling. Option A is incorrect because reducing shards reduces the stream capacity, causing backpressure and potential data loss.

Option B is incorrect because increasing memory does not reduce the number of invocations; it only speeds up processing per invocation, but still processes one record at a time. Option C is incorrect because Kinesis Data Firehose can batch records, but it still uses per-record Lambda transformation if you use a Lambda function, or it can use built-in transformations but not the flexible logic described. The most direct solution is to batch records in the existing Lambda function via event source mapping parameters.

Exam trap

A candidate might think that reducing the number of shards will reduce invocations, but that actually reduces the stream's ability to handle the data volume and can cause throttling or data loss.

Full explanation →

704

Multi-Selectmedium

Which TWO actions should a data engineer take to optimize Amazon S3 query performance for Amazon Athena when dealing with large Parquet files? (Choose 2.)

Select 2 answers

A.Store data in a single large file without partitioning

B.Use GZIP compression on the Parquet files

C.Split large files into many small files

D.Optimize file sizes to be around 64 MB to 256 MB

E.Partition the data by frequently filtered columns

AnswersD, E

Optimal file size improves parallelism and performance.

Why this answer

The correct answers are D and E. Optimizing file sizes to be around 64 MB to 256 MB (D) reduces the overhead of Athena reading many small files or processing overly large files, balancing parallelism and efficiency. Partitioning data by frequently filtered columns (E) allows Athena to prune partitions and scan less data, improving query performance.

Option A (single large file) hinders parallelism and query performance. Option B (GZIP compression) is already supported by Parquet and does not inherently optimize query performance beyond the file size considerations. Option C (many small files) increases metadata overhead and degrades performance.

Full explanation →

705

MCQmedium

A data engineer notices that an AWS Glue ETL job is running slower than expected. The job reads from Amazon S3, joins two datasets, and writes the result back to S3. The job uses the default worker type (G.1X) and 10 DPUs. Which action is most likely to improve performance?

A.Increase the number of DPUs to 20

B.Repartition the data before the join operation

C.Use coalesce to reduce the number of output files

D.Change the worker type to G.2X

AnswerB

Optimizes parallelism and reduces shuffling.

Why this answer

The default G.1X worker type provides 16 GB of memory and 4 vCPUs per DPU. With 10 DPUs, the job likely has sufficient compute but suffers from data skew or inefficient partitioning during the join. Repartitioning the data before the join ensures that keys are evenly distributed across partitions, reducing shuffle overhead and preventing straggler tasks, which directly improves performance.

Exam trap

The trap here is that candidates often assume more DPUs or a larger worker type always speeds up a job, but the DEA-C01 exam tests understanding that shuffle optimization (like repartitioning) is the most impactful fix for join performance issues.

How to eliminate wrong answers

Option A is wrong because increasing DPUs to 20 adds more parallelism but does not address the root cause of poor join performance, which is data skew or uneven partitioning; it may even increase shuffle overhead. Option C is wrong because coalesce reduces the number of output files by merging partitions, which is useful for downstream S3 reads but does not improve join performance and can actually cause data movement that slows the job. Option D is wrong because changing to G.2X (which doubles memory and vCPUs per DPU) may help memory-intensive operations but does not fix the partitioning issue; the job is likely I/O or shuffle-bound, not memory-bound.

Full explanation →

706

MCQhard

A data engineer needs to share a dataset stored in an S3 bucket with a partner AWS account. The partner should be able to read the data without needing to authenticate with the engineer's account. The engineer must not share any secret keys. Which approach should be used?

A.Write a bucket policy that grants access to the partner account's IAM role.

B.Generate presigned URLs and share them with the partner.

C.Make the bucket publicly readable.

D.Create an IAM user with access keys and share them with the partner.

AnswerA

Bucket policy can grant cross-account access securely.

Why this answer

S3 bucket policies can grant cross-account access to a specific IAM role in the partner account, allowing the partner to read data without authentication or shared secrets. Option B is wrong because presigned URLs are temporary and require ongoing generation for each access, not a persistent solution. Option C is wrong because making the bucket public violates security principles and exposes data to everyone.

Option D is wrong because sharing access keys is insecure and against best practices; keys should never be shared.

Exam trap

Candidates often confuse presigned URLs with a secure long-term solution, but they are temporary and not suitable for persistent cross-account access.

Full explanation →

707

MCQhard

A healthcare organization uses AWS Lake Formation to manage a data lake in Amazon S3. The data lake contains sensitive patient information that must be encrypted at rest. The organization uses AWS KMS with a customer-managed key (CMK) for encryption. Recently, the security team noticed that a new IAM user was able to query the data lake using Amazon Athena without explicit permissions in Lake Formation. The data lake administrator suspects that the IAM user might have been granted access through an IAM policy that allows 'lakeformation:GetDataAccess' without proper resource restrictions. The organization wants to enforce that only Lake Formation permissions control access to the data lake, and IAM policies should not grant access directly. What should they do?

A.Change the KMS key policy to require that any request to decrypt data must come from the Lake Formation service role.

B.Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.

C.Remove the IAM policy that grants 'lakeformation:GetDataAccess' from the specific user and ensure Lake Formation permissions are correctly set.

D.Add an S3 bucket policy that denies all principals except the Lake Formation service role.

AnswerB

This ensures that only Lake Formation permissions control data access.

Why this answer

Revoking the 'lakeformation:GetDataAccess' permission from all IAM users and groups ensures that only Lake Formation permissions control access to the data lake. This prevents IAM policies from bypassing Lake Formation's fine-grained access control. Option A is wrong because changing the KMS key policy would not address the IAM policy issue; KMS controls encryption, not access permissions.

Option C is wrong because removing the policy from a single user does not prevent other users from having similar permissions; a broader revocation is needed. Option D is wrong because S3 bucket policies would still allow direct S3 access, bypassing Lake Formation's controls.

Full explanation →

708

MCQmedium

A data engineer needs to store semi-structured JSON data from IoT devices. The data is written once, read rarely, but must be queryable using SQL. The storage cost must be minimized. Which storage solution should the engineer choose?

A.Store JSON in Amazon Redshift as SUPER data type

B.Store JSON in an Amazon RDS for MySQL table

C.Store JSON documents in Amazon DynamoDB and use PartiQL for queries

D.Store JSON files in Amazon S3 and use Amazon Athena for queries

AnswerD

S3 provides low-cost storage; Athena enables SQL querying over JSON.

Why this answer

Amazon S3 provides the lowest-cost storage for data that is written once and rarely read, while Amazon Athena enables serverless SQL querying directly on JSON files stored in S3. This combination minimizes storage costs because S3 charges only for the data stored and retrieval, with no minimum fees or provisioning required, and Athena charges only for the data scanned per query. The workload's write-once, read-rarely pattern aligns perfectly with S3's durability and lifecycle policies, making it the most cost-effective choice.

Exam trap

The trap here is that candidates often choose DynamoDB (Option C) because it supports JSON natively and PartiQL provides SQL-like queries, but they overlook that DynamoDB's provisioned throughput and storage costs are significantly higher than S3 for write-once, read-rarely workloads, and that Athena on S3 is the serverless, cost-optimized solution for ad-hoc SQL queries on infrequently accessed data.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a petabyte-scale data warehouse designed for high-performance analytics on structured and semi-structured data, but it incurs significant costs for provisioned clusters even when data is rarely queried, making it unsuitable for minimizing storage costs. Option B is wrong because Amazon RDS for MySQL is a relational database that requires provisioning and paying for a database instance 24/7, and storing JSON in a MySQL table incurs overhead for indexing and transactions that are unnecessary for write-once, read-rarely data. Option C is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for low-latency, high-throughput workloads, but its storage costs are higher than S3 for rarely accessed data, and PartiQL queries on DynamoDB still consume read capacity units, leading to ongoing costs that exceed S3+Athena for infrequent queries.

Full explanation →

709

MCQmedium

Refer to the exhibit. A data engineer is configuring an IAM policy for an AWS Glue ETL job that reads data from the 'my-data-bucket' S3 bucket, transforms it, and writes the output back to the same bucket. The engineer wants to prevent accidental deletion of objects. Based on the policy, which statement is true about the Glue job's permissions?

A.The job can write objects but cannot read objects.

B.The job can read objects but cannot write objects.

C.The job can read and write, but may also delete objects.

D.The job can read and write objects, but cannot delete objects.

AnswerD

Get and Put allowed; Delete denied.

Why this answer

The IAM policy explicitly denies the `s3:DeleteObject` action, which prevents the Glue job from deleting objects in the 'my-data-bucket' S3 bucket. The policy allows `s3:GetObject` and `s3:PutObject` actions, enabling the job to read and write objects as required for the ETL process. This ensures the job can perform its transformation tasks without the risk of accidental deletion.

Exam trap

The trap here is that candidates may overlook the explicit deny statement and assume the job has full S3 access based on the allow actions, forgetting that an explicit deny overrides all allows.

How to eliminate wrong answers

Option A is wrong because the policy includes `s3:GetObject` permission, allowing the job to read objects, not just write. Option B is wrong because the policy includes `s3:PutObject` permission, allowing the job to write objects, not just read. Option C is wrong because the policy explicitly denies `s3:DeleteObject`, so the job cannot delete objects, contradicting the claim that it may also delete.

Full explanation →

710

MCQeasy

A data engineer is ingesting streaming data from an IoT fleet into Amazon S3 using Amazon Kinesis Data Firehose. The data arrives as JSON, but the downstream analytics require Parquet format. Which Firehose transformation should the engineer configure?

A.Use an S3 lifecycle policy to convert JSON to Parquet.

B.Configure a Lambda function as a data transformation in Firehose to convert JSON to Parquet.

C.Use S3 Batch Operations to convert existing JSON objects to Parquet.

D.Use Kinesis Data Analytics to convert the stream to Parquet before writing to S3.

AnswerB

Lambda can transform data format during delivery.

Why this answer

Amazon Kinesis Data Firehose can invoke an AWS Lambda function as a data transformation step to convert incoming JSON records to Parquet format before delivery to S3. This is the native, serverless way to perform record-level format conversion within the Firehose delivery stream, ensuring downstream analytics tools can directly query the Parquet data without additional processing.

Exam trap

The trap here is that candidates may confuse S3 lifecycle policies or Batch Operations as viable transformation tools, overlooking that Firehose's Lambda integration is the only option that performs real-time, record-level format conversion within the streaming pipeline.

How to eliminate wrong answers

Option A is wrong because S3 lifecycle policies manage object lifecycle transitions (e.g., to Glacier) or expiration, not format conversion; they cannot change JSON to Parquet. Option C is wrong because S3 Batch Operations are designed for bulk actions on existing objects (e.g., tagging, copying) and are not suitable for real-time streaming data conversion. Option D is wrong because Kinesis Data Analytics processes streaming data with SQL or Flink but does not natively output Parquet to S3; it would require a custom sink or additional transformation, making it an overly complex and indirect solution compared to Firehose's built-in Lambda transformation.

Full explanation →

711

MCQeasy

A company wants to ingest data from an on-premises Oracle database into Amazon S3 on a daily basis. The data volume is 500 GB per transfer. Which AWS service is most appropriate for this batch ingestion?

A.AWS Database Migration Service (DMS)

B.AWS Data Pipeline

C.Amazon Kinesis Data Firehose

D.AWS Glue

AnswerD

Glue can run scheduled crawlers and ETL jobs for batch ingestion.

Why this answer

AWS Glue is the most appropriate service for this batch ingestion because it is purpose-built for ETL (Extract, Transform, Load) workflows, including connecting to on-premises databases via JDBC, extracting large volumes of data (500 GB per day), and writing it to Amazon S3 in a scheduled, serverless manner. Glue's built-in crawlers and job scheduler handle daily batch runs efficiently without requiring manual infrastructure management, making it ideal for this use case.

Exam trap

The trap here is that candidates often confuse AWS Glue (batch ETL) with Amazon Kinesis Data Firehose (streaming), assuming both can handle any data ingestion, but Firehose cannot pull from a relational database and is not designed for large daily batch loads.

How to eliminate wrong answers

Option A is wrong because AWS DMS is designed for continuous, real-time database replication and migration, not for scheduled daily batch ingestion of 500 GB into S3; it focuses on keeping source and target in sync rather than periodic bulk loads. Option B is wrong because AWS Data Pipeline is a legacy service that requires managing EC2 instances and has been largely superseded by AWS Glue for ETL workloads; it lacks the serverless simplicity and native integration with Glue's catalog and crawlers. Option C is wrong because Amazon Kinesis Data Firehose is built for streaming data ingestion (near real-time, small records) and cannot handle 500 GB batch transfers from an on-premises Oracle database via JDBC; it expects data to be pushed via HTTP, Kinesis Streams, or SDK, not pulled from a relational database.

Full explanation →

712

MCQhard

Refer to the exhibit. A data engineer is reviewing the configuration of an Amazon Redshift cluster. The engineer wants to ensure that the cluster can be restored to a point in time up to 35 days in the past. Based on the exhibit, what change is needed?

A.Increase the automated snapshot retention period to 35 days.

B.Change the cluster subnet group to a custom one.

C.Enable encryption on the cluster.

D.Increase the number of nodes to 6.

AnswerA

Current retention is 1 day.

Why this answer

The automated snapshot retention period is currently set to 1 day, which only allows point-in-time recovery within the last day. To restore to a point in time up to 35 days in the past, this retention period must be increased to 35 days. Option B (changing the subnet group) does not affect backup retention.

Option C (enabling encryption) is unrelated to snapshot retention; the cluster may already be encrypted or not, but encryption does not extend the retention period. Option D (increasing the number of nodes) also does not affect snapshot retention.

Full explanation →

713

MCQmedium

A data engineer is building a data ingestion pipeline that reads JSON files from Amazon S3 and loads them into an Amazon Redshift table using COPY commands. The files are gzip compressed and contain nested JSON. The engineer wants to minimize transformation steps. Which approach should the engineer use?

A.Use Amazon Athena to query the JSON and INSERT INTO Redshift.

B.Use Kinesis Data Firehose to transform and load into Redshift.

C.Use the COPY command with the 'auto' option to ingest JSON directly.

D.Use AWS Glue ETL to flatten the JSON and write to S3 as CSV, then COPY from CSV.

AnswerC

COPY with 'auto' automatically parses JSON.

Why this answer

The COPY command with the 'auto' option can directly ingest gzip-compressed JSON files from S3 into Redshift, automatically inferring the schema and handling nested structures without requiring intermediate transformation steps. This minimizes transformation steps by leveraging Redshift's native JSON parsing capability, which supports both 'auto' and 'jsonpaths' options for nested data.

Exam trap

The trap here is that candidates often overcomplicate the solution by assuming nested JSON requires an ETL tool like Glue or Athena, when Redshift's COPY command with 'auto' or 'jsonpaths' can handle nested structures natively, minimizing transformation steps as explicitly requested.

How to eliminate wrong answers

Option A is wrong because using Athena to query JSON and then INSERT INTO Redshift adds unnecessary transformation steps and latency, as Athena is an interactive query service not designed for high-throughput ingestion pipelines, and the INSERT approach lacks the parallelism and compression handling of COPY. Option B is wrong because Kinesis Data Firehose is optimized for streaming data, not batch ingestion from S3, and it would require additional configuration to read from S3 and transform JSON, introducing extra complexity and cost. Option D is wrong because using AWS Glue ETL to flatten JSON to CSV adds an unnecessary transformation step, contradicting the requirement to minimize transformation steps; the COPY command can directly handle nested JSON without flattening.

Full explanation →

714

MCQeasy

A data engineer is troubleshooting an AWS Glue ETL job that uses a Python shell script to extract data from an Amazon RDS for PostgreSQL database and load it into an Amazon Redshift table. The job runs successfully, but the data engineer notices that the row count in Redshift is consistently lower than the row count in PostgreSQL. The job uses a SELECT * query without any filtering. The data engineer suspects that some rows are being dropped during the transfer. The job uses the psycopg2 library to connect to PostgreSQL and the psycopg2 connection is configured with autocommit=True. The Redshift table has no constraints that would reject rows. What is the most likely cause of the missing rows?

A.The SELECT * query includes columns with data types that are not supported by psycopg2.

B.The SSL/TLS connection to PostgreSQL is dropping packets.

C.The autocommit=True setting is causing incomplete transactions.

D.The Redshift table has a distribution key that causes some rows to be silently discarded.

AnswerA

Unsupported data types may cause rows to be skipped or nullified.

Why this answer

The SELECT * query may include columns with data types (e.g., arrays, hstore, or geometric types) that psycopg2 does not fully support, causing those columns to be read as NULL or silently skipped during extraction. This would result in fewer rows being inserted into Redshift if the unsupported columns are part of a unique constraint or if NULL handling causes row drops. Option B is incorrect because SSL/TLS packet drops would cause connection errors, not consistent missing rows.

Option C is incorrect because autocommit=True ensures each query is a standalone transaction, preventing incomplete transactions. Option D is incorrect because the problem states the Redshift table has no constraints that would reject rows, and distribution keys do not silently discard rows.

Full explanation →

715

Multi-Selecthard

Which THREE are valid considerations when troubleshooting data loss in an AWS Glue ETL job? (Choose three.)

Select 3 answers

A.Job bookmarks may be skipping new data if not configured properly.

B.Server-side encryption is disabled on the S3 bucket.

C.The job timeout is set too low.

D.Dynamic frame transformations may drop rows with errors.

E.The mapping of source columns to target columns may be incorrect.

AnswersA, D, E

Bookmarks control reprocessing.

Why this answer

Options A, D, and E are correct. Job bookmarks may skip new data if not configured properly (A). Dynamic frame transformations can drop rows if errors occur during processing (D).

Incorrect mapping of source columns to target columns can cause data loss (E). Option B is incorrect because disabling server-side encryption on S3 does not cause data loss; it affects data at rest encryption but not data integrity during ETL. Option C is incorrect because setting the job timeout too low may cause the job to fail prematurely, but it does not directly cause data loss; data can be reprocessed after adjusting the timeout.

Full explanation →

716

Multi-Selecteasy

A data engineer is setting up a data pipeline using Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data must be transformed using an AWS Lambda function before delivery. Which THREE steps are required to configure this?

Select 3 answers

A.Create a Lambda@Edge function in the same Region.

B.Create an AWS Lambda function that transforms the data.

C.Attach an IAM role to the Firehose delivery stream that grants permission to invoke the Lambda function.

D.Configure an S3 event notification to trigger the Lambda function when new data arrives.

E.Configure the Kinesis Data Firehose delivery stream to use the Lambda function as a data transformation source.

AnswersB, C, E

A Lambda function is needed to perform the transformation logic.

Why this answer

Options B, C, and E are correct. To configure Kinesis Data Firehose with Lambda transformation, you need to create a Lambda function that transforms the data (B), attach an IAM role to the Firehose delivery stream that allows Firehose to invoke the Lambda function (C), and configure the Firehose delivery stream to use the Lambda function as a data transformation source (E). Option A is wrong because Lambda@Edge is used with CloudFront, not Firehose.

Option D is wrong because S3 event notifications are not used for Firehose transformation; they are used for other purposes like triggering Lambda on new S3 objects.

Full explanation →

717

MCQhard

Refer to the exhibit. A data engineer runs this AWS CLI command to create a Glue job. The job processes JSON files in an S3 bucket and writes Parquet files to another bucket. After the first successful run, the job re-processes all input files instead of only new files. What is the most likely cause?

A.The ScriptLocation points to an incorrect S3 path.

B.The --max-retries parameter is set to 0.

C.The job script does not implement job bookmark support.

D.The IAM role lacks permissions to read bookmark state.

AnswerC

Bookmarks require explicit implementation in the script.

Why this answer

The command sets '--job-bookmark-enable' but if the job script does not use the bookmark APIs or implement bookmark support, Glue will not track processed files and will reprocess all input on each run. Option A is incorrect because the ScriptLocation is valid and does not affect bookmark behavior. Option B is incorrect because max-retries does not control reprocessing.

Option D is incorrect because the IAM role is specified and permissions for bookmark state are not explicitly shown, but the lack of bookmark support in the script is the issue.

Full explanation →

718

Multi-Selecthard

A data engineering team is building a data lake on Amazon S3. They need to ingest data from multiple sources: (1) streaming IoT data, (2) daily CSV exports from an on-premises system via SFTP, and (3) change data capture (CDC) from an Amazon Aurora database. Which THREE services should the team use to ingest these data sources?

Select 3 answers

A.Amazon Kinesis Data Streams for IoT data ingestion.

B.AWS Database Migration Service (DMS) for CDC from Aurora.

C.AWS Transfer Family for SFTP-based file ingestion.

D.AWS Glue ETL for CDC from Aurora.

E.Amazon EMR for daily CSV ingestion.

AnswersA, B, C

Kinesis is ideal for real-time streaming data from devices.

Why this answer

Amazon Kinesis Data Streams is purpose-built for real-time streaming data ingestion, making it ideal for IoT data that arrives continuously. It can capture and store data streams for processing by consumers like Kinesis Data Analytics or Lambda, providing low-latency ingestion and durable storage.

Exam trap

The trap here is confusing AWS Glue ETL (a batch ETL tool) with AWS DMS (a database migration and CDC service), and assuming Amazon EMR is an ingestion service rather than a processing framework for large-scale data transformations.

Full explanation →

719

MCQmedium

Refer to the exhibit. A data engineer has attached this IAM policy to an AWS Glue job role. The Glue job fails when trying to write transformed data to an S3 bucket located in a different AWS account. What is the most likely reason?

A.The policy does not allow lambda:InvokeAsync

B.The Glue job role does not have permissions to write to S3

C.The policy does not grant s3:ListBucket, and the bucket policy may not allow cross-account access

D.The policy does not include kinesis:DescribeStream

AnswerC

Cross-account S3 access requires both bucket policy and IAM permissions, including ListBucket.

Why this answer

The IAM policy shown does not include the s3:ListBucket permission, which is required for the Glue job to list objects in the S3 bucket before writing. Additionally, cross-account access requires both the source account's IAM policy (this one) to grant write permissions and the target account's S3 bucket policy to explicitly allow the source account's role, which may not be configured. Without s3:ListBucket, the Glue job cannot verify the bucket's existence or structure, causing the write operation to fail.

Exam trap

The trap here is that candidates assume s3:PutObject alone is sufficient for writing to S3, but AWS requires s3:ListBucket for bucket-level operations like listing and validation, especially in cross-account scenarios where the bucket's existence must be confirmed.

How to eliminate wrong answers

Option A is wrong because lambda:InvokeAsync is a permission for invoking AWS Lambda functions asynchronously, which is irrelevant to writing data to S3 from a Glue job. Option B is wrong because the policy does include s3:PutObject and s3:PutObjectAcl, which are write permissions; the failure is due to missing s3:ListBucket, not a lack of write permissions entirely. Option D is wrong because kinesis:DescribeStream is a permission for Amazon Kinesis streams, which is unrelated to S3 write operations in this cross-account scenario.

Full explanation →

720

MCQmedium

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon Aurora MySQL. After the migration, the data in Aurora is inconsistent with the source. The engineer needs to ensure ongoing replication with minimal downtime. Which solution should the engineer implement?

A.Use AWS Schema Conversion Tool (SCT) to convert the schema

B.Export the data from Oracle and import into Aurora using mysqldump

C.Configure a DMS task with change data capture (CDC)

D.Perform a full load migration again

AnswerC

CDC captures ongoing changes.

Why this answer

Configuring a DMS task with Change Data Capture (CDC) enables ongoing replication of changes from the source Oracle database to the target Aurora MySQL database with minimal downtime, ensuring consistency. Option A is incorrect because AWS Schema Conversion Tool (SCT) only converts schema and does not handle data replication. Option B is incorrect because mysqldump provides a one-time export/import, not ongoing replication.

Option D is incorrect because performing a full load migration again would disrupt operations and would not capture ongoing changes.

Full explanation →

721

Multi-Selecteasy

A company wants to audit all API calls made to Amazon S3 and Amazon RDS resources. Which TWO AWS services can be used together to achieve this?

Select 2 answers

A.AWS CloudTrail

B.AWS Config

C.Amazon GuardDuty

D.Amazon Macie

E.Amazon CloudWatch Logs

AnswersA, E

AWS CloudTrail records API calls to S3 and RDS, enabling auditing of all actions.

Why this answer

Options A and E are correct. AWS CloudTrail records API calls to S3 and RDS, and Amazon CloudWatch Logs can store and monitor those logs. Option B (AWS Config) records resource configuration changes, not API calls, so it is incorrect.

Option C (Amazon GuardDuty) is a threat detection service, not for auditing API calls. Option D (Amazon Macie) is for data classification and protection, not for recording API calls.

Full explanation →

722

MCQhard

A data engineer is reviewing the S3 Lifecycle policy for a data lake bucket. The goal is to archive log data after 30 days and delete it after 365 days, and delete temporary data after 1 day. What is wrong with the current configuration?

A.The prefix filter for the first rule does not include a wildcard, so it may not match all log files.

B.The rule for temp data has no transition, so it will not expire objects.

C.The expiration for the first rule will not delete objects in GLACIER storage class unless they are restored first.

D.The transition to GLACIER should be after 30 days, but the expiration should be after 365 days from the transition, not from creation.

AnswerD

The Days in lifecycle rules are always from the object creation date, not from the transition.

Why this answer

The current lifecycle configuration is correct: it transitions objects to GLACIER after 30 days and expires them 365 days after creation. However, a common mistake is to configure expiration relative to the transition date. Option D identifies this error by stating that expiration should be based on creation date, not transition.

The other options are incorrect: A - prefix filters do not require wildcards; B - expiration actions do not need a prior transition; C - S3 Lifecycle can expire GLACIER objects without restoration.

Exam trap

Many candidates think that expiration for GLACIER objects requires prior restoration, but AWS documentation states that expiration can delete objects directly. Also, expiration is always based on creation date, not transition date.

Full explanation →

723

MCQmedium

A company is using Amazon DynamoDB to store session data for a web application. The data engineer needs to ensure that the data is encrypted at rest. Which action should the data engineer take?

A.Enable encryption at rest on the DynamoDB Accelerator (DAX) cluster.

B.Use client-side encryption before writing to DynamoDB.

C.Ensure encryption at rest is enabled on the DynamoDB table (default).

D.Enable DynamoDB Time to Live (TTL) to encrypt data.

AnswerC

DynamoDB encrypts at rest by default using AWS KMS.

Why this answer

DynamoDB tables are encrypted at rest by default using AWS Key Management Service (KMS) with an AWS owned key. The data engineer does not need to take any additional action to enable encryption at rest, as it is automatically enabled for all new DynamoDB tables. This ensures that all data stored on disk, including the table's primary key, local secondary indexes, and global secondary indexes, is encrypted before being written to SSDs in AWS data centers.

Exam trap

The trap here is that candidates may assume encryption at rest must be explicitly enabled or configured, when in fact DynamoDB enables it by default for all tables, leading them to incorrectly select client-side encryption or other unrelated options.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that does not store data at rest; it only caches data in memory, and encryption at rest is not a configurable feature for DAX clusters. Option B is wrong because client-side encryption is an additional security measure that encrypts data before sending it to DynamoDB, but it is not required to meet the requirement of encryption at rest, which is already provided by DynamoDB's default server-side encryption. Option D is wrong because DynamoDB Time to Live (TTL) is a feature that automatically deletes expired items from a table to manage storage costs; it does not provide any encryption functionality.

Full explanation →

724

MCQmedium

A company is ingesting streaming data from a fleet of weather sensors. Each sensor sends a JSON payload every second. The data is used for real-time dashboarding and also archived to S3. The pipeline should handle sudden bursts of data without data loss. Which architecture meets these requirements?

A.Amazon EC2 with Apache Kafka -> S3

B.Amazon Kinesis Data Streams -> AWS Lambda for dashboard -> Amazon Kinesis Data Firehose -> S3

C.Amazon Kinesis Data Firehose directly with no buffer

D.Amazon SQS -> AWS Lambda -> S3

AnswerB

Streams provide buffer, Firehose delivers to S3, Lambda processes for dashboard.

Why this answer

Kinesis Data Streams provides durable, scalable ingestion that can handle sudden bursts of data without loss, while Lambda processes records for real-time dashboarding and Kinesis Data Firehose reliably buffers and archives data to S3. This decoupled architecture ensures no data is lost even during traffic spikes, as Kinesis Data Streams retains data for up to 365 days and Firehose can buffer incoming records before writing to S3.

Exam trap

The DEA-C01 exam often tests the misconception that Kinesis Data Firehose can be used as a standalone ingestion service without a buffer, but the trap here is that Firehose requires a buffer (minimum 60 seconds or 1 MB) to function, and without it, data would be lost during bursts, making Option C an incorrect choice.

How to eliminate wrong answers

Option A is wrong because Apache Kafka on EC2 introduces operational overhead for managing brokers, partitions, and replication, and does not natively integrate with S3 without additional tooling like Kafka Connect or a custom consumer, making it less reliable for a fully managed serverless pipeline. Option C is wrong because Kinesis Data Firehose with no buffer cannot handle sudden bursts of data; it requires a buffer interval (minimum 60 seconds) or buffer size to accumulate records before delivery, and without buffering it would fail to absorb spikes, leading to data loss or throttling. Option D is wrong because Amazon SQS does not guarantee order preservation for streaming data (unless using FIFO, which limits throughput) and Lambda's 6-minute timeout and lack of native S3 archiving make it unsuitable for continuous, high-frequency ingestion and archival without additional components like Firehose.

Full explanation →

725

Multi-Selecthard

A company is using Amazon EMR to run Spark jobs. The jobs are failing due to memory issues. Which THREE configurations can help mitigate out-of-memory errors?

Select 3 answers

A.Configure instance store volumes for intermediate shuffle data.

B.Use instances with more vCPUs to process more tasks in parallel.

C.Tune Spark memory configurations like spark.executor.memory and spark.memory.fraction.

D.Increase the instance type to one with more memory per node.

E.Enable Spark dynamic allocation to adjust executors based on workload.

AnswersC, D, E

Correct. Tuning parameters like spark.executor.memory and spark.memory.fraction controls how much JVM heap and unified memory are available for execution and storage, directly mitigating OOM errors.

Why this answer

The correct options are C, D, and E. Tuning Spark memory configurations (C) such as spark.executor.memory and spark.memory.fraction directly controls memory allocation within executors. Increasing the instance type to one with more memory per node (D) provides additional physical memory for Spark workloads.

Enabling Spark dynamic allocation (E) allows the cluster to automatically adjust the number of executors based on workload, which helps prevent memory pressure from over-allocation. Option A is incorrect because instance store volumes are used for temporary data storage (e.g., shuffle spills) but do not address memory constraints; they may help with disk I/O but not OOM errors. Option B is incorrect because increasing vCPUs increases parallelism, which can actually worsen memory contention if each task consumes significant memory, potentially leading to more OOM errors.

Full explanation →

726

MCQeasy

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

A.VPC Flow Logs

B.AWS CloudTrail

C.AWS Config

D.Amazon Inspector

AnswerB

CloudTrail records KMS API calls for auditing.

Why this answer

(AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls.

Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.

Full explanation →

727

MCQmedium

A data engineer attempts to suspend versioning on an S3 bucket but receives the error shown. The engineer needs to suspend versioning to reduce storage costs. What should the engineer do FIRST?

A.Disable MFA Delete by using the AWS CLI with the --mfa parameter and then suspend versioning.

B.Use the AWS Management Console to suspend versioning, as it bypasses MFA Delete.

C.Delete the bucket and recreate it without versioning.

D.Add a bucket policy to allow versioning suspension.

AnswerA

MFA Delete must be disabled first; this requires the root account and MFA device.

Why this answer

To suspend versioning on an S3 bucket with MFA Delete enabled, you must first disable MFA Delete using the root account (or an account with appropriate permissions). The AWS CLI with the --mfa parameter is used to authenticate with MFA when performing sensitive operations, but disabling MFA Delete requires the root account. After disabling MFA Delete, versioning can be suspended.

Option B is incorrect because the AWS Management Console does not bypass MFA Delete; you still need to disable MFA Delete first. Option C is incorrect because deleting and recreating the bucket is unnecessarily disruptive and versioning can be suspended directly after disabling MFA Delete. Option D is incorrect because the error is due to MFA Delete being enabled, not a bucket policy issue.

Full explanation →

728

MCQmedium

A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?

A.The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.

B.The S3 bucket has Object Ownership set to BucketOwnerPreferred.

C.The bucket policy does not allow the target account's root user.

D.The VPC Endpoint policy blocks access from the target account.

AnswerA

Correct. The KMS key policy must grant the target account's IAM role kms:Decrypt permission to allow decryption of objects encrypted with that key.

Why this answer

For cross-account access to an S3 bucket encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the target account's IAM role the kms:Decrypt permission. Without this, the target account will get access denied errors even if the bucket policy and IAM role are correctly configured. Option B is incorrect because Object Ownership does not affect cross-account read access.

Option C is incorrect because the bucket policy only needs to allow the target account's IAM role, not the root user. Option D is incorrect because VPC Endpoint policies are not relevant to this cross-account access issue.

Full explanation →

729

MCQeasy

A data engineer deploys the CloudFormation template shown in the exhibit. After 60 days, what will be the storage class of objects in the bucket?

A.The objects will be in GLACIER storage class.

B.The objects will be deleted.

C.The objects will remain in STANDARD storage class because the rule is not triggered.

D.The objects will be immediately transitioned to GLACIER upon creation.

AnswerA

The CloudFormation template includes a lifecycle rule that transitions objects to the GLACIER storage class after 60 days. Since the rule is configured with a transition action to GLACIER, objects will be moved from their initial storage class (typically STANDARD) to GLACIER once they reach 60 days of age. This matches the correct answer.

Why this answer

The CloudFormation template includes a lifecycle rule with a transition action to the GLACIER storage class after 60 days from object creation. Since the rule is properly configured and no expiration action is defined, objects will be moved from STANDARD to GLACIER at day 60. This is standard S3 lifecycle behavior, and objects are not deleted unless a separate expiration rule is set.

Exam trap

The trap here is that candidates may confuse the Days parameter with a countdown from the rule creation date rather than from the object's creation date, or assume that a lifecycle rule without an explicit expiration means objects are deleted by default.

How to eliminate wrong answers

Option B is wrong because the lifecycle rule only specifies a transition to GLACIER, not an expiration action; objects are not deleted unless explicitly configured with an expiration policy. Option C is wrong because the lifecycle rule is triggered automatically by S3 based on the object's age, and the rule will execute the transition to GLACIER after 60 days, so objects will not remain in STANDARD. Option D is wrong because the transition is not immediate upon creation; it occurs after the specified number of days (60 days) have elapsed from the object's creation date, as per the Days parameter in the lifecycle rule.

Full explanation →

730

MCQeasy

A data engineer needs to store transaction data that requires strong consistency, ACID transactions, and complex join queries. Which AWS service is most appropriate?

A.Amazon DynamoDB

B.Amazon RDS for PostgreSQL

C.Amazon S3

D.Amazon Redshift

AnswerB

RDS PostgreSQL provides ACID transactions and complex join support.

Why this answer

Amazon RDS for PostgreSQL is the most appropriate choice because it provides full ACID transaction support, strong consistency, and the ability to perform complex join queries using standard SQL. Unlike NoSQL or data warehouse solutions, PostgreSQL is a relational database that excels at enforcing referential integrity and supporting multi-table joins with advanced indexing.

Exam trap

The trap here is that candidates often confuse DynamoDB's 'eventually consistent reads' with strong consistency, or assume its limited transaction API can replace full ACID relational databases, but the question explicitly requires complex joins and ACID transactions, which only a relational database like PostgreSQL can provide.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support complex join queries or ACID transactions across multiple items (it only offers limited transactional APIs with restrictions). Option C is wrong because Amazon S3 is an object storage service with no support for ACID transactions, complex joins, or relational query capabilities. Option D is wrong because Amazon Redshift is a columnar data warehouse optimized for analytical queries on large datasets, not for transactional workloads requiring ACID compliance and complex joins at the row level.

Full explanation →

731

Multi-Selecthard

A data engineer is troubleshooting a slow-running Amazon Redshift query. The query joins several large tables and performs aggregations. The engineer runs EXPLAIN and sees a 'DS_DIST_ALL' step. Which TWO actions will MOST likely improve query performance? (Choose TWO.)

Select 2 answers

A.Run the VACUUM command on all tables.

B.Use the CNAME command to rename the tables.

C.Change the distribution style of the tables to DISTSTYLE KEY on the join columns.

D.Increase the number of nodes in the Redshift cluster.

E.Define appropriate SORTKEYs on the tables based on the query predicates.

AnswersC, E

Reduces data redistribution across nodes.

Why this answer

The DS_DIST_ALL step in the query plan indicates that data is being broadcast from one node to all others, causing significant network overhead. Option C is correct because changing the distribution style to DISTSTYLE KEY on the join columns ensures that matching rows are co-located on the same node, reducing the need for redistribution. Option E is correct because defining appropriate SORTKEYs based on query predicates allows the query optimizer to use zone maps to skip irrelevant blocks, speeding up scans and aggregations.

Option A is incorrect; VACUUM reorganizes data on disk but does not affect distribution. Option B is incorrect; CNAME is a DNS record type, not a Redshift command. Option D is incorrect; increasing nodes might not directly fix the distribution issue and is less targeted than changing distribution style.

Full explanation →

732

Multi-Selectmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format, and each record is approximately 5 KB. The company has set the buffer interval to 60 seconds and the buffer size to 5 MB. However, the data engineer observes that the delivery to S3 is delayed by up to 5 minutes during peak traffic. The engineer wants to reduce the delivery latency to under 1 minute. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers

A.Enable GZIP compression for the delivery stream.

B.Reduce the buffer size to 1 MB.

C.Increase the buffer size to 50 MB.

D.Convert the data format to Apache Parquet before delivery.

E.Reduce the buffer interval to 10 seconds.

AnswersB, E

A smaller buffer size triggers delivery sooner when the size threshold is reached.

Why this answer

Reducing the buffer size to 1 MB triggers delivery sooner once the smaller size threshold is met, reducing latency. Option E is correct because reducing the buffer interval to 10 seconds forces Firehose to deliver data more frequently, also reducing latency. Option A is wrong because GZIP compression reduces data volume but does not directly reduce delivery latency; it may even add processing time.

Option C is wrong because increasing the buffer size would make it take longer to fill, increasing latency. Option D is wrong because converting to Parquet requires additional processing and does not directly reduce latency; it may increase it.

Full explanation →

733

MCQeasy

A company needs to ingest data from an external API that returns CSV files daily. The files range from 100 MB to 2 GB. The data should be landed in Amazon S3 and then transformed using AWS Glue. Which ingestion method is most cost-effective and requires the least operational overhead?

A.Set up AWS DataSync to transfer the file from the API endpoint to S3

B.Use Amazon Kinesis Data Firehose with a direct PUT

C.Deploy an AWS Direct Connect connection to the external API for faster transfer

D.Schedule an AWS Lambda function to download the CSV file and upload it to Amazon S3

AnswerD

Simple, cost-effective, and serverless for daily files.

Why this answer

Scheduling an AWS Lambda function to download the CSV file from the external API and upload it to Amazon S3 is the most cost-effective and operationally lightweight approach. Lambda can handle files up to 2 GB (with appropriate memory and timeout settings) and runs on a serverless, pay-per-execution model, eliminating the need for infrastructure management. This method directly addresses the daily, batch-oriented nature of the data ingestion without requiring additional services or complex configurations.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing streaming or dedicated network services (like Kinesis Firehose or Direct Connect) for a simple batch ingestion task, failing to recognize that a serverless, scheduled Lambda function is the most cost-effective and low-overhead approach for daily CSV file transfers from an external API.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for transferring data between on-premises storage and AWS, not for pulling data from an external API endpoint; it cannot directly interface with an HTTP-based API that returns CSV files. Option B is wrong because Amazon Kinesis Data Firehose with a direct PUT is optimized for streaming, real-time data ingestion, not for handling large, daily batch CSV files up to 2 GB; it would introduce unnecessary complexity and cost for a simple scheduled batch transfer. Option C is wrong because AWS Direct Connect provides a dedicated network connection from on-premises to AWS, but it does not connect to an external API; it is intended for hybrid cloud architectures and would be overkill, costly, and operationally heavy for this use case.

Full explanation →

734

MCQhard

A company uses AWS Glue to process sensitive data. The security team requires that all data in transit between Glue and Amazon S3 be encrypted using TLS 1.2 or higher. Which configuration ensures this requirement is met?

A.Configure a VPC endpoint for S3 and enable private DNS

B.Enable S3 Block Public Access at the bucket level

C.Add a bucket policy that denies access unless aws:SecureTransport is true

D.Use SSE-KMS encryption on the S3 bucket

AnswerC

Enforces HTTPS, which typically uses TLS 1.2+.

Why this answer

S3 bucket policies can enforce aws:SecureTransport to require HTTPS. Glue by default uses HTTPS when accessing S3, but to enforce it, the bucket policy must deny requests without SecureTransport. Option A is wrong because VPC endpoints enforce private connectivity but not necessarily TLS version.

Option B is wrong because S3 Block Public Access does not affect encryption in transit. Option D is wrong because KMS is for at-rest encryption. Option C is correct.

Full explanation →

735

MCQeasy

A data engineer applies the above IAM policy to a user. The user attempts to upload an object to the bucket 'my-data-lake' without specifying server-side encryption. What will happen?

A.The upload fails only if the bucket has a default encryption setting

B.The upload succeeds if the bucket policy allows unencrypted uploads

C.The upload succeeds because the policy allows s3:PutObject

D.The upload fails because the condition requires encryption

AnswerD

The condition requires AES256 encryption; not provided.

Why this answer

The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present with a value of `AES256`. When the user attempts to upload an object without specifying server-side encryption, the condition is not satisfied, so the `s3:PutObject` permission is denied. This causes the upload to fail, regardless of any bucket default encryption settings or bucket policies.

Exam trap

The trap here is that candidates assume bucket default encryption automatically satisfies an IAM condition requiring the encryption header, but the condition checks the request headers, not the bucket's configuration.

How to eliminate wrong answers

Option A is wrong because the failure is due to the IAM policy condition, not the bucket's default encryption setting; even if the bucket has no default encryption, the IAM policy still denies the upload. Option B is wrong because the bucket policy is irrelevant here—the IAM policy explicitly denies unencrypted uploads via a condition, and bucket policies cannot override an explicit IAM deny. Option C is wrong because while the policy allows `s3:PutObject` in general, the condition `s3:x-amz-server-side-encryption` must be met; without it, the permission is effectively denied.

Full explanation →

736

MCQhard

A data engineer is troubleshooting an Amazon Redshift cluster that has been experiencing slow query performance. The engineer checks the system tables and finds that many queries are waiting on 'wlm_queued' time. The cluster has 10 nodes and uses automatic WLM. What is the most likely cause?

A.Network bandwidth saturation between nodes.

B.Sorting operations are too expensive.

C.The number of concurrent queries exceeds the available query slots.

D.Insufficient disk space on the cluster.

AnswerC

Automatic WLM limits concurrency, and queries queue when exceeded.

Why this answer

When queries show 'wlm_queued' time in Amazon Redshift, it indicates they are waiting in the Workload Management (WLM) queue before execution. With automatic WLM, the system dynamically manages concurrency, but if the number of concurrent queries exceeds the available query slots (determined by the cluster's memory and concurrency scaling settings), queries will be queued. This is the most direct cause of 'wlm_queued' wait events, as WLM queues queries when all slots are occupied.

Exam trap

The trap here is that candidates confuse 'wlm_queued' with resource contention (like CPU or I/O), but WLM queuing specifically indicates a concurrency limit, not a performance bottleneck during execution.

How to eliminate wrong answers

Option A is wrong because network bandwidth saturation between nodes would manifest as 'network' or 'distributed' wait events in system tables, not 'wlm_queued' time, which is purely a queuing delay. Option B is wrong because expensive sorting operations would appear as 'sort' or 'hash' wait times in query execution plans, not as WLM queue wait; sorting occurs after a query is assigned a slot. Option D is wrong because insufficient disk space would cause 'disk full' errors or 'resize' operations, not WLM queuing; Redshift's WLM queuing is independent of storage capacity.

Full explanation →

737

MCQhard

A company runs a data warehouse on Amazon Redshift. The data engineer notices that some queries are running slowly. Upon reviewing the system tables, the engineer finds that the 'svv_table_info' shows high 'unsorted' percentage for several large tables. What is the MOST effective action to improve query performance?

A.Run the ANALYZE command on the tables.

B.Run the VACUUM command on the tables.

C.Change the distribution style of the tables to ALL.

D.Increase the number of nodes in the Redshift cluster.

AnswerB

VACUUM sorts the data, improving query performance.

Why this answer

VACUUM sorts the data and reclaims space, improving query performance. Option A is wrong because ANALYZE updates statistics but does not sort. Option C is wrong because increasing the number of nodes may help but is not the most direct fix for unsorted data.

Option D is wrong because changing distribution style would require recreating the table.

Full explanation →

738

MCQmedium

A company wants to ingest data from an on-premises SQL Server database into Amazon Redshift. They need to transform the data during ingestion, such as masking PII columns. Which approach meets these requirements with minimal operational overhead?

A.Use AWS Glue ETL jobs to extract data from SQL Server, transform it, and load into Redshift

B.Use a custom application on EC2 to extract, transform, and load

C.Use Kinesis Data Firehose to stream data from SQL Server to Redshift

D.Use AWS Database Migration Service (DMS) with transformation rules

AnswerD

DMS supports data transformation and loads into Redshift.

Why this answer

AWS DMS can perform transformations, such as data masking, during the migration process and can load data directly into Amazon Redshift, minimizing operational overhead. Option A (AWS Glue ETL) adds an extra step and overhead compared to DMS. Option B (custom application on EC2) introduces high operational overhead for management and scaling.

Option C (Kinesis Data Firehose) is designed for streaming data and is not suitable for batch ingestion from an on-premises SQL Server database.

Full explanation →

739

MCQhard

A data engineer is designing a data ingestion pipeline for a social media company. The pipeline ingests user posts from a REST API into Amazon S3. The API returns JSON data with an array of posts. The engineer needs to transform the data into individual JSON objects per post and store them in S3 with a partition structure of year/month/day/hour. The data should be available in S3 within 15 minutes of ingestion. The engineer decides to use AWS Lambda for transformation. Which combination of services should the engineer use to meet these requirements with minimal operational overhead?

A.Use AWS Step Functions to orchestrate an API call and data transformation with Lambda, running every 15 minutes.

B.Use Amazon CloudWatch Events to trigger an AWS Lambda function every 15 minutes. The Lambda function calls the API, transforms the data, and writes individual JSON objects to S3 with the required partition structure.

C.Use AWS Glue ETL jobs scheduled with AWS Glue triggers to run every 15 minutes.

D.Use Amazon Kinesis Data Firehose with a Lambda function for transformation. Configure Firehose to pull from the API every 15 minutes.

AnswerB

Simple and cost-effective for periodic API polling.

Why this answer

Using Amazon CloudWatch Events (or EventBridge) to trigger an AWS Lambda function every 15 minutes provides a simple, serverless solution with minimal operational overhead. The Lambda function can call the REST API, transform the array of posts into individual JSON objects, and write them to S3 with the partition structure year/month/day/hour. This meets the 15-minute latency requirement without managing infrastructure.

Option A (AWS Step Functions) adds unnecessary orchestration complexity for a simple scheduled task. Option C (AWS Glue ETL) is too heavyweight for this lightweight transformation and incurs additional cost and setup. Option D (Amazon Kinesis Data Firehose) is designed for streaming data, not periodic batch API calls; it cannot pull from an API on a schedule without custom logic, making it less suitable.

Full explanation →

740

Multi-Selecthard

Which THREE factors should a data engineer consider when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose THREE.)

Select 3 answers

A.Requirement for ACID transactions across multiple tables.

B.Expected latency requirements for read/write operations.

C.Need for complex joins and relationships.

D.Ability to encrypt data at rest.

E.Support for multi-region disaster recovery.

AnswersA, B, C

RDS offers full ACID; DynamoDB transactions are limited.

Why this answer

Amazon RDS (with engines like PostgreSQL or MySQL) supports ACID transactions across multiple tables, ensuring atomicity, consistency, isolation, and durability for complex operations. DynamoDB, while supporting transactions, is limited to a single AWS account and region, and its transactional API has constraints on item sizes and throughput, making RDS the better choice for multi-table ACID compliance.

Exam trap

The trap here is that candidates assume encryption at rest or multi-region DR are exclusive to one service, but both RDS and DynamoDB offer these features, making them irrelevant for choosing between the two.

Full explanation →

741

Multi-Selectmedium

A data engineer is troubleshooting a slow-running Amazon Athena query. The query scans a large amount of data. Which TWO actions can improve query performance? (Choose TWO.)

Select 2 answers

A.Convert the data to Parquet or ORC format.

B.Enable encryption at rest.

C.Increase the Athena query timeout.

D.Partition the table on frequently filtered columns.

E.Use SELECT * to retrieve all columns.

AnswersA, D

Columnar formats reduce I/O and improve compression.

Why this answer

Converting data to columnar formats like Parquet or ORC reduces the amount of data scanned, and partitioning the table on frequently filtered columns allows Athena to skip reading irrelevant partitions. Both actions improve query performance. Option B (encryption) does not affect performance.

Option C (increasing timeout) only allows more time for a slow query, not improving performance. Option E (SELECT *) scans all columns, which increases data scanned and worsens performance.

Full explanation →

742

MCQmedium

A data engineer is troubleshooting an AWS Glue ETL job that fails with an OutOfMemory error when processing large JSON files from Amazon S3. The files contain deeply nested structures. Which approach should the engineer take to resolve this issue?

A.Use the `recurse` option with `getResolvedOptions` to limit recursion

B.Increase the number of workers in the Glue job configuration

C.Increase the DPU (Data Processing Unit) per worker

D.Decrease the number of partitions while reading the data

AnswerC

More DPU per worker allocates more memory, resolving OOM.

Why this answer

Increasing the DPU per worker allocates more memory per worker, directly addressing the OutOfMemory error when processing large files. Option A is incorrect because the `recurse` option is not a valid argument for `getResolvedOptions`, which is used for retrieving job parameters. Option B is incorrect because increasing the number of workers adds parallelism but does not increase memory per worker; OOM occurs per worker.

Option D is incorrect because decreasing partitions reduces parallelism, potentially causing each partition to be larger, worsening the memory issue.

Full explanation →

743

Multi-Selectmedium

A company is designing a data ingestion pipeline for clickstream data from a website. The data must be ingested in near real-time. Which TWO services can be used together to build this pipeline?

Select 2 answers

A.Amazon Kinesis Data Streams

B.Amazon Simple Queue Service (SQS)

C.Amazon S3

D.Amazon Kinesis Data Firehose

E.Amazon DynamoDB

AnswersA, D

Amazon Kinesis Data Streams can ingest clickstream data in near real-time, making it suitable for the pipeline.

Why this answer

Amazon Kinesis Data Streams can ingest clickstream data in near real-time. Option D is correct because Amazon Kinesis Data Firehose can deliver that streaming data to destinations like S3. Option B is wrong because SQS is a message queuing service, not a streaming ingestion service.

Option C is wrong because S3 is a storage service, not a real-time ingestion service. Option E is wrong because DynamoDB is a NoSQL database, not a streaming ingestion service.

Full explanation →

744

MCQhard

A data engineer is troubleshooting a slow Amazon Redshift query. The query scans a large table with interleaved sort keys. The engineer notices that the query plan shows a sequential scan instead of a range-restricted scan. What is the MOST likely reason?

A.The table has not been vacuumed and reindexed after large data loads.

B.The table has a poor distribution key (DISTKEY) causing data skew.

C.The table uses compression encodings that prevent range-restricted scans.

D.The workload management (WLM) queue is configured with too few query slots.

AnswerA

Without VACUUM REINDEX, interleaved sort keys lose effectiveness, causing sequential scans.

Why this answer

Interleaved sort keys require periodic VACUUM REINDEX to maintain sort order. Without it, Redshift may fall back to sequential scans. Option B is incorrect because DISTKEY affects data distribution, not sort key usage.

Option C is incorrect because compression does not prevent range-restricted scans. Option D is incorrect because WLM queue slots affect concurrency, not scan type.

Full explanation →

745

MCQmedium

Refer to the exhibit. An AWS Glue ETL job is failing with an OutOfMemoryError. The job reads from Amazon S3 and performs a GROUP BY on a large dataset. Which change should the data engineer make to resolve this error?

A.Use coalesce to reduce the number of partitions.

B.Increase the number of DPUs allocated to the Glue job.

C.Increase the number of partitions in the DataFrame.

D.Use repartition to increase the number of partitions.

AnswerB

More DPUs increase total memory available.

Why this answer

The OutOfMemoryError in an AWS Glue ETL job performing a GROUP BY on a large dataset indicates that the executors do not have enough memory to handle the shuffle operations required for aggregation. Increasing the number of DPUs (Data Processing Units) allocated to the Glue job increases the total memory and compute resources available, allowing the job to process larger partitions without running out of memory.

Exam trap

The trap here is that candidates often confuse partition tuning (coalesce/repartition) with resource allocation, mistakenly thinking that adjusting partitions alone can fix memory errors without increasing the underlying compute and memory capacity.

How to eliminate wrong answers

Option A is wrong because using coalesce to reduce the number of partitions would decrease parallelism and concentrate data into fewer partitions, potentially worsening memory pressure and making the OutOfMemoryError more likely. Option C is wrong because increasing the number of partitions in the DataFrame without adding more resources (DPUs) would spread data across more tasks but still rely on the same total memory, which does not resolve the underlying memory shortage. Option D is wrong because repartitioning to increase the number of partitions similarly does not add memory; it only redistributes data, which can even increase shuffle overhead and exacerbate memory issues.

Full explanation →

746

Multi-Selecteasy

A data engineer is designing a data ingestion pipeline to load JSON files from Amazon S3 into Amazon Redshift. Which TWO methods can be used to load the data efficiently?

Select 2 answers

A.Use Amazon Kinesis Data Firehose to directly load into Redshift.

B.Use AWS DMS to replicate from S3 to Redshift.

C.Use the Redshift COPY command to load from S3.

D.Use a staging table in S3 and then COPY into Redshift.

E.Use individual INSERT statements in a loop.

AnswersC, D

COPY is the fastest way to bulk load from S3.

Why this answer

The Redshift COPY command is specifically designed to efficiently load large datasets from Amazon S3 by automatically parallelizing the data across cluster nodes, leveraging the cluster's compute resources for high-throughput ingestion. It supports JSON data natively via the 'json' option, making it ideal for loading JSON files directly from S3 without intermediate transformations.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose's ability to 'deliver' to Redshift with the actual loading mechanism, not realizing that Firehose only writes to S3 and then triggers a COPY command, making Option A a distractor for a direct load method.

Full explanation →

747

Multi-Selectmedium

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Select 2 answers

A.S3 Versioning

B.Server-Side Encryption with S3 Managed Keys (SSE-S3)

C.Server-Side Encryption with AWS KMS (SSE-KMS)

D.S3 Transfer Acceleration

E.S3 Object Lock

AnswersB, C

SSE-S3 encrypts data at rest.

Why this answer

Server-Side Encryption with S3 Managed Keys (SSE-S3) and Server-Side Encryption with AWS KMS (SSE-KMS) both encrypt data at rest. Option A (S3 Versioning) protects against accidental deletion or overwrite, not encryption. Option D (S3 Transfer Acceleration) speeds up data transfers, not encryption.

Option E (S3 Object Lock) prevents deletion or overwrite for compliance, not encryption.

Full explanation →

748

MCQhard

A data engineer needs to design a data ingestion pipeline that captures change data capture (CDC) events from an on-premises SQL Server database to Amazon S3 with low latency. The pipeline must handle schema changes and ensure exactly-once delivery semantics. Which combination of AWS services should the engineer use?

A.AWS Database Migration Service (DMS) with Amazon Kinesis Data Firehose to Amazon S3

B.AWS AppFlow with SQL Server connector to Amazon S3

C.AWS Glue ETL job with JDBC connection to SQL Server and writing to Amazon S3

D.Amazon Kinesis Data Streams with AWS Lambda consumer writing to Amazon S3

AnswerA

DMS captures CDC, Firehose delivers to S3 with low latency and supports partitioning.

Why this answer

AWS DMS can capture ongoing changes from SQL Server using its CDC capability and stream them directly into Amazon Kinesis Data Firehose, which buffers and delivers data to Amazon S3 with low latency. DMS handles schema changes by propagating them to the target, and Kinesis Data Firehose, combined with DMS's transactional integrity, supports exactly-once delivery semantics when configured with a primary key and appropriate error handling.

Exam trap

The trap here is that candidates often assume AWS Glue or Kinesis Data Streams are the default for real-time CDC, but they overlook DMS's native CDC support for on-premises databases and its seamless integration with Firehose for exactly-once delivery.

How to eliminate wrong answers

Option B is wrong because AWS AppFlow does not support CDC from on-premises SQL Server; it is designed for SaaS applications and requires a public endpoint, not on-premises databases. Option C is wrong because AWS Glue ETL jobs with JDBC are batch-oriented, not real-time, and cannot provide low-latency CDC or exactly-once delivery without complex custom checkpointing. Option D is wrong because Amazon Kinesis Data Streams with a Lambda consumer does not natively integrate with SQL Server CDC; it would require custom code to capture changes, and Lambda does not guarantee exactly-once delivery to S3 due to potential retries and lack of idempotency handling.

Full explanation →

749

MCQmedium

A data engineer needs to migrate an on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. Which approach should they use?

A.Use mysqldump to export the database and import into RDS.

B.Use AWS Database Migration Service (DMS) with ongoing replication from the source database.

C.Create an RDS read replica and promote it.

D.Use AWS Schema Conversion Tool (SCT) to convert the schema and then copy data.

AnswerB

DMS with ongoing replication minimizes downtime by continuously syncing changes.

Why this answer

AWS DMS with ongoing replication (change data capture, CDC) is the correct approach because it allows continuous synchronization from the on-premises MySQL source to the RDS target, enabling a cutover with minimal downtime. Unlike one-time export/import tools, DMS captures ongoing changes during the migration, so the target stays up-to-date until you switch over.

Exam trap

The trap here is that candidates confuse 'minimal downtime' with 'zero data loss' and assume a simple dump/import or a read replica (which only works for RDS-to-RDS) is sufficient, overlooking the need for ongoing replication to keep the target synchronized during the migration window.

How to eliminate wrong answers

Option A is wrong because mysqldump performs a logical backup that requires the source database to be locked or read-only during the dump, causing significant downtime; it also does not support ongoing replication. Option C is wrong because RDS read replicas can only be created from an existing RDS instance, not from an on-premises database, and promoting a replica does not migrate data from an external source. Option D is wrong because AWS Schema Conversion Tool (SCT) is designed for heterogeneous migrations (e.g., Oracle to Aurora) and does not handle data replication; for a homogeneous MySQL-to-MySQL migration, SCT is unnecessary and does not provide ongoing sync.

Full explanation →

750

MCQeasy

A data engineer needs to store semi-structured JSON data that is accessed infrequently but must be retrievable within minutes when needed. The data will be stored for 7 years for compliance. Which storage solution is MOST cost-effective?

A.Amazon S3 One Zone-Infrequent Access

B.Amazon S3 Standard

C.Amazon S3 Intelligent-Tiering

D.Amazon S3 Glacier Deep Archive

AnswerD

Lowest cost for long-term archival with retrieval within 12 hours (standard) or minutes (expedited at extra cost).

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that is accessed infrequently, requires retrieval within minutes (using expedited retrieval), and must be stored for 7 years for compliance. It offers the lowest storage cost among S3 classes, making it ideal for long-term archival of semi-structured JSON data with minimal access needs.

Exam trap

The trap here is that candidates often confuse 'infrequent access' with 'One Zone-Infrequent Access' or 'Standard-IA,' overlooking that Glacier Deep Archive is specifically designed for archival compliance data with retrieval times that can be expedited to minutes, not hours.

How to eliminate wrong answers

Option A is wrong because S3 One Zone-Infrequent Access is designed for infrequently accessed data but does not provide the lowest cost for 7-year retention and lacks the durability of multi-AZ storage, which is critical for compliance data. Option B is wrong because S3 Standard is optimized for frequently accessed data with low latency and high throughput, making it unnecessarily expensive for data accessed only a few times over 7 years. Option C is wrong because S3 Intelligent-Tiering automatically moves data between access tiers to optimize costs, but it incurs monitoring and automation fees that make it less cost-effective than Glacier Deep Archive for data that is almost never accessed and stored for long durations.

Full explanation →

Page 10 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and Transformation Data Operations and Support Data Security and Governance Data Store Management

See all domains with question counts →